CVE-2025-30204
HighAdvisory
Published 21 Mar 2025In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.5
- base score, highest
- EPSS
- 0.007
- 52nd percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 589
- of 17,787 indexed, latest versions
- Container images
- 628
- deployed by those charts
- Fix available
- 2 of 3
- affected packages
jwt-go allows excessive memory allocation during header parsing
Carried by container images the latest versions of 589 of 17,787 indexed charts deploy, on 628 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| github.com/ | v4.0.0, v4.1.0, v4.2.0, v4.3.0+5 more | 4.5.2 | 458 |
| github.com/ | v5.0.0, v5.1.0, v5.2.0, v5.2.1 | 5.2.2 | 184 |
| github.com/ | v3.2.1+incompatible, v3.2.2+incompatible | no fix listed | 131 |
- OSV records
- GHSA-mh63-6h87-95cp
- Also known as
- GO-2025-3553
Charts affected
589 by stars
Container images carrying it
628 by charts deploying them
A fixed version is listed for 2 of the 3 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| ghcr.io/ | a61c7022abcf | github.com/ github.com/ | 4.5.2 5.2.2 | 1 |
| ghcr.io/ | 832a32779e6d | github.com/ github.com/ | 4.5.2 5.2.2 | 1 |
| ghcr.io/ | 185d2eebc60c | github.com/ | 4.5.2 | 1 |
| ghcr.io/ | 63f7eaf5aa8a | github.com/ github.com/ | 4.5.2 5.2.2 | 1 |
| ghcr.io/ | c62e3347611c | github.com/ github.com/ | 4.5.2 5.2.2 | 1 |
| ghcr.io/ | 6650119a385f | github.com/ | no fix listed | 1 |
| ghcr.io/ | e459ad3ae758 | github.com/ | no fix listed | 1 |
| ghcr.io/ | 23dc6274cc4b | github.com/ | no fix listed | 1 |
| ghcr.io/ | 528f2174fa2f | github.com/ | 5.2.2 | 1 |
| ghcr.io/ | 5dfa86b6451f | github.com/ | 4.5.2 | 1 |
| ghcr.io/ | 45e744fc623f | github.com/ | 4.5.2 | 1 |
| ghcr.io/ | df917c5a7e54 | github.com/ github.com/ | 4.5.2 5.2.2 | 1 |
| ghcr.io/ | 7fbc6855c8b3 | github.com/ github.com/ | 4.5.2 5.2.2 | 1 |
| ghcr.io/ | 17369c4cd390 | github.com/ | 4.5.2 | 1 |
| ghcr.io/ | 056f0953763d | github.com/ | 4.5.2 | 1 |
| ghcr.io/ | 9c7bc0f9bb35 | github.com/ | 5.2.2 | 1 |
| ghcr.io/ | bacc9b78ec61 | github.com/ | 5.2.2 | 1 |
| ghcr.io/ | b61c750ade19 | github.com/ | 4.5.2 | 1 |
| ghcr.io/ | a89958921526 | github.com/ | 5.2.2 | 1 |
| ghcr.io/ | 14450f52a708 | github.com/ | 4.5.2 | 1 |
| ghcr.io/ | 9066d7b3e6a1 | github.com/ | 4.5.2 | 1 |
| ghcr.io/ | 8df071f5b719 | github.com/ | 5.2.2 | 1 |
| ghcr.io/ | d96366e208b1 | github.com/ | 4.5.2 | 1 |
| ghcr.io/ | 379e583a0a75 | github.com/ | 5.2.2 | 1 |
| ghcr.io/ | 349f7dca95ec | github.com/ | 5.2.2 | 1 |
| ghcr.io/ | e9ab76a4ec77 | github.com/ | 4.5.2 | 1 |
| ghcr.io/ | d44ed3b3128c | github.com/ | 5.2.2 | 1 |
| ghcr.io/ | 6d6794f45f3e | github.com/ | 5.2.2 | 1 |
| ghcr.io/ | f0c6f7d7daa6 | github.com/ | 4.5.2 | 1 |
| ghcr.io/ | 0fae829caf29 | github.com/ | no fix listed | 1 |
| ghcr.io/ | aab0c99d313f | github.com/ | no fix listed | 1 |
| ghcr.io/ | ab41ffa78f69 | github.com/ | 4.5.2 | 1 |
| ghcr.io/ | 511231955463 | github.com/ | 4.5.2 | 1 |
| ghcr.io/ | 76a19ddc3626 | github.com/ | no fix listed | 1 |
| ghcr.io/ | 1eee8e20a87f | github.com/ github.com/ | no fix listed 4.5.2 | 1 |
| ghcr.io/ | 62517726d0c4 | github.com/ | 4.5.2 | 1 |
| ghcr.io/ | 635b9024cad2 | github.com/ | 4.5.2 | 1 |
| ghcr.io/ | 3a98245a7667 | github.com/ | 5.2.2 | 1 |
| ghcr.io/ | 759f3850eda9 | github.com/ | 5.2.2 | 1 |
| ghcr.io/ | e9bde36e34b7 | github.com/ | 4.5.2 | 1 |
| ghcr.io/ | d7bdfa7b41da | github.com/ | 4.5.2 | 1 |
| ghcr.io/ | 647e45284a80 | github.com/ | 4.5.2 | 1 |
| ghcr.io/ | 2c807cd41ed4 | github.com/ | 5.2.2 | 1 |
| ghcr.io/ | 81a9ebc899a4 | github.com/ | 4.5.2 | 1 |
| ghcr.io/ | 2f1408c94168 | github.com/ | 4.5.2 | 1 |
| ghcr.io/ | 416c1c5aeb86 | github.com/ | 4.5.2 | 1 |
| ghcr.io/ | 322f5f8cc105 | github.com/ | 4.5.2 | 1 |
| ghcr.io/ | e5ecfd607e42 | github.com/ | no fix listed | 1 |
| ghcr.io/ | 4723d86e6797 | github.com/ github.com/ | no fix listed 5.2.2 | 1 |
| ghcr.io/ | efb69ec3330c | github.com/ | 5.2.2 | 1 |